{"level":"info","ts":"2026-11-02T00:39:30.787Z","logger":"kuadrant-operator","msg":"go version: go1.26.7 (Red Hat 1.26.7-2.el9_8) X:strictfipsruntime"}
{"level":"info","ts":"2026-11-02T00:39:30.787Z","logger":"kuadrant-operator","msg":"go os/arch: linux/amd64"}
{"level":"info","ts":"2026-11-02T00:39:30.787Z","logger":"kuadrant-operator","msg":"base logger","log level":"info","log mode":"production"}
{"level":"info","ts":"2026-11-02T00:39:30.787Z","logger":"kuadrant-operator","msg":"build information","version":"1.6.0","commit":"3ff72e9d8db90bd7b351ac2ecd8c6667335f8a9a","dirty":"false"}
{"level":"info","ts":"2026-11-02T00:39:33.035Z","logger":"kuadrant-operator","msg":"envoygateway is not installed, skipping related watches and reconcilers"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator.extensions","msg":"Discovered extension","name":"oidc-policy","path":"/extensions/oidc-policy/oidc-policy"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator.extensions","msg":"Discovered extension","name":"plan-policy","path":"/extensions/plan-policy/plan-policy"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator.extensions","msg":"Discovered extension","name":"telemetry-policy","path":"/extensions/telemetry-policy/telemetry-policy"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"consoleplugin watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"servicemonitor watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"kuadrant watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"limitador deployment watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"authconfig watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"certificate watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"wasm server"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"limitador-operator deployment watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"gatewayclass watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"grpcroute watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"podmonitor watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"gateway watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"topology configmap watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"dnsrecord watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"networkPolicy watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"issuers watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"clusterissuers watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"kuadrant-operator deployment watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"apiserver watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"tokenratelimitpolicy watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"httproute watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"cluster version watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"dnspolicy watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"limitador watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"authorino watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"consoleplugin networkpolicy watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"authpolicy watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"tlspolicy watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"ratelimitpolicy watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"authorino-operator deployment watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"extension manager"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"envoyfilter watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"peerauthentication watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"dns-operator deployment watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.036Z","logger":"kuadrant-operator","msg":"starting runnable","name":"authorino deployment watcher"}
{"level":"info","ts":"2026-11-02T00:39:33.037Z","logger":"kuadrant-operator.extensions.extension","msg":"starting session reaper","ttl":45,"interval":15}
{"level":"info","ts":"2026-11-02T00:39:33.037Z","logger":"kuadrant-operator.extensions.extension.oidc-policy","msg":"starting..."}
{"level":"info","ts":"2026-11-02T00:39:33.037Z","logger":"kuadrant-operator.extensions.extension.oidc-policy","msg":"started"}
{"level":"info","ts":"2026-11-02T00:39:33.037Z","logger":"kuadrant-operator.extensions.extension.plan-policy","msg":"starting..."}
{"level":"info","ts":"2026-11-02T00:39:33.037Z","logger":"kuadrant-operator.extensions.extension.plan-policy","msg":"started"}
{"level":"info","ts":"2026-11-02T00:39:33.038Z","logger":"kuadrant-operator.extensions.extension.telemetry-policy","msg":"starting..."}
{"level":"info","ts":"2026-11-02T00:39:33.038Z","logger":"kuadrant-operator.extensions.extension.telemetry-policy","msg":"started"}
{"level":"info","ts":"2026-11-02T00:39:33.038Z","logger":"kuadrant-operator.extensions.extension","msg":"starting descriptor service","port":50051}
{"level":"info","ts":"2026-11-02T00:39:33.038Z","logger":"kuadrant-operator.extensions.extension","msg":"starting extension service","port":50052}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"telemetry-policy-extension-controller","msg":"Starting EventSource","controller":"telemetry-policy-extension-controller","source":"kind source: *v1alpha1.TelemetryPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"telemetry-policy-extension-controller","msg":"Starting EventSource","controller":"telemetry-policy-extension-controller","source":"channel source: 0xd415d475c70"}
{"level":"info","ts":"2026-11-02T00:39:33.058Z","logger":"kuadrant-operator.WasmServer","msg":"starting wasm server (h2c)","port":8082,"file":"/wasm/plugin.wasm","sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"plan-policy-extension-controller","msg":"Starting EventSource","controller":"plan-policy-extension-controller","source":"channel source: 0x34182c80700"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"plan-policy-extension-controller","msg":"Starting EventSource","controller":"plan-policy-extension-controller","source":"kind source: *v1alpha1.PlanPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"plan-policy-extension-controller","msg":"Starting EventSource","controller":"plan-policy-extension-controller","source":"kind source: *v1.RateLimitPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"channel source: 0x11e20a798070"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"kind source: *v1alpha1.OIDCPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"kind source: *v1.HTTPRoute"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"kind source: *v1.AuthPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33.137Z","logger":"kuadrant-operator.controller-runtime.metrics","msg":"Starting metrics server"}
{"level":"info","ts":"2026-11-02T00:39:33.137Z","logger":"kuadrant-operator","msg":"starting server","name":"pprof","addr":"[::]:8084"}
{"level":"info","ts":"2026-11-02T00:39:33.137Z","logger":"kuadrant-operator","msg":"starting server","name":"health probe","addr":"[::]:8081"}
{"level":"info","ts":"2026-11-02T00:39:33.138Z","logger":"kuadrant-operator.controller-runtime.metrics","msg":"Serving metrics server","bindAddress":":8080","secure":false}
{"level":"info","ts":"2026-11-02T00:39:33.138Z","logger":"kuadrant-operator","msg":"Attempting to acquire leader lease...","lock":"kuadrant-system/f139389e.kuadrant.io"}
{"level":"info","ts":"2026-11-02T00:39:33.243Z","logger":"kuadrant-operator","msg":"Successfully acquired lease","lock":"kuadrant-system/f139389e.kuadrant.io"}
{"level":"info","ts":"2026-11-02T00:39:33.243Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"kuadrant-control-plane","controllerGroup":"kuadrant.io","controllerKind":"KuadrantControlPlane","source":"kind source: *v1.CustomResourceDefinition"}
{"level":"info","ts":"2026-11-02T00:39:33.243Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"kuadrant-control-plane","controllerGroup":"kuadrant.io","controllerKind":"KuadrantControlPlane","source":"kind source: *v1alpha1.KuadrantControlPlane"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"kuadrant-control-plane","controllerGroup":"kuadrant.io","controllerKind":"KuadrantControlPlane","source":"kind source: *v1.Deployment"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ServiceMonitor"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ConsolePlugin"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Deployment"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.GatewayClass"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1beta1.Kuadrant"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ClusterVersion"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.DNSPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Deployment"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1beta3.AuthConfig"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Certificate"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.GRPCRoute"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha1.Limitador"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.PodMonitor"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1beta1.Authorino"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Gateway"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.NetworkPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.AuthPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.TLSPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.RateLimitPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Deployment"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ConfigMap"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha3.EnvoyFilter"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha1.DNSRecord"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.PeerAuthentication"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.NetworkPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33.244Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Deployment"}
{"level":"info","ts":"2026-11-02T00:39:33.245Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Deployment"}
{"level":"info","ts":"2026-11-02T00:39:33.245Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ClusterIssuer"}
{"level":"info","ts":"2026-11-02T00:39:33.245Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Deployment"}
{"level":"info","ts":"2026-11-02T00:39:33.245Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.APIServer"}
{"level":"info","ts":"2026-11-02T00:39:33.245Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha1.TokenRateLimitPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33.245Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.HTTPRoute"}
{"level":"info","ts":"2026-11-02T00:39:33.245Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Issuer"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"telemetry-policy-extension-controller","msg":"Starting Controller","controller":"telemetry-policy-extension-controller"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"telemetry-policy-extension-controller","msg":"Starting workers","controller":"telemetry-policy-extension-controller","worker count":1}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"plan-policy-extension-controller","msg":"Starting Controller","controller":"plan-policy-extension-controller"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"plan-policy-extension-controller","msg":"Starting workers","controller":"plan-policy-extension-controller","worker count":1}
{"level":"info","ts":"2026-11-02T00:39:33.513Z","logger":"kuadrant-operator.extensions.extensionService","msg":"handshake accepted","identity":"telemetry-policy","version":"0.1.0","policyKind":"TelemetryPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"oidc-policy-controller","msg":"Starting Controller","controller":"oidc-policy-controller"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"oidc-policy-controller","msg":"Starting workers","controller":"oidc-policy-controller","worker count":1}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"telemetry-policy-extension-controller","msg":"handshake accepted","extension":"telemetry-policy-extension-controller","policyKind":"TelemetryPolicy","protocolVersion":"0.1.0","operatorProtocolVersion":"0.1.0"}
{"level":"info","ts":"2026-11-02T00:39:33.527Z","logger":"kuadrant-operator.extensions.extensionService","msg":"handshake accepted","identity":"plan-policy","version":"0.1.0","policyKind":"PlanPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33.528Z","logger":"kuadrant-operator.extensions.extensionService","msg":"handshake accepted","identity":"oidc-policy","version":"0.1.0","policyKind":"OIDCPolicy"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"plan-policy-extension-controller","msg":"handshake accepted","extension":"plan-policy-extension-controller","policyKind":"PlanPolicy","protocolVersion":"0.1.0","operatorProtocolVersion":"0.1.0"}
{"level":"info","ts":"2026-11-02T00:39:33Z","logger":"oidc-policy-controller","msg":"handshake accepted","extension":"oidc-policy-controller","policyKind":"OIDCPolicy","protocolVersion":"0.1.0","operatorProtocolVersion":"0.1.0"}
{"level":"info","ts":"2026-11-02T00:39:33.619Z","logger":"kuadrant-operator.controlplane.bootstrap","msg":"created default KuadrantControlPlane"}
{"level":"info","ts":"2026-11-02T00:39:33.906Z","logger":"kuadrant-operator.controlplane.bootstrap.olm-cleanup","msg":"cleaned OLM metadata","resource":"customresourcedefinitions","name":"dnsrecords.kuadrant.io"}
{"level":"info","ts":"2026-11-02T00:39:33.958Z","logger":"kuadrant-operator.controlplane.bootstrap.olm-cleanup","msg":"cleaned OLM metadata","resource":"customresourcedefinitions","name":"dnshealthcheckprobes.kuadrant.io"}
{"level":"info","ts":"2026-11-02T00:39:34.187Z","logger":"kuadrant-operator.controlplane.bootstrap.olm-cleanup","msg":"cleaned OLM metadata","resource":"customresourcedefinitions","name":"mcpgatewayextensions.mcp.kuadrant.io"}
{"level":"info","ts":"2026-11-02T00:39:34.240Z","logger":"kuadrant-operator.controlplane.bootstrap.olm-cleanup","msg":"cleaned OLM metadata","resource":"customresourcedefinitions","name":"mcpserverregistrations.mcp.kuadrant.io"}
{"level":"info","ts":"2026-11-02T00:39:34.292Z","logger":"kuadrant-operator.controlplane.bootstrap.olm-cleanup","msg":"cleaned OLM metadata","resource":"customresourcedefinitions","name":"mcpvirtualservers.mcp.kuadrant.io"}
{"level":"info","ts":"2026-11-02T00:39:34.507Z","logger":"kuadrant-operator.controlplane.bootstrap.olm-cleanup","msg":"cleaned OLM metadata","resource":"customresourcedefinitions","name":"authconfigs.authorino.kuadrant.io"}
{"level":"info","ts":"2026-11-02T00:39:34.560Z","logger":"kuadrant-operator.controlplane.bootstrap.olm-cleanup","msg":"cleaned OLM metadata","resource":"customresourcedefinitions","name":"authorinos.operator.authorino.kuadrant.io"}
{"level":"info","ts":"2026-11-02T00:39:34.644Z","logger":"kuadrant-operator","msg":"Starting Controller","controller":"kuadrant-control-plane","controllerGroup":"kuadrant.io","controllerKind":"KuadrantControlPlane"}
{"level":"info","ts":"2026-11-02T00:39:34.644Z","logger":"kuadrant-operator","msg":"Starting workers","controller":"kuadrant-control-plane","controllerGroup":"kuadrant.io","controllerKind":"KuadrantControlPlane","worker count":1}
{"level":"info","ts":"2026-11-02T00:39:34.645Z","logger":"kuadrant-operator.controlplane.reconciler","msg":"reconciling KuadrantControlPlane","name":"default"}
{"level":"info","ts":"2026-11-02T00:39:34.649Z","logger":"kuadrant-operator","msg":"Starting Controller","controller":"controller"}
{"level":"info","ts":"2026-11-02T00:39:34.649Z","logger":"kuadrant-operator","msg":"Starting workers","controller":"controller","worker count":1}
{"level":"info","ts":"2026-11-02T00:39:34.786Z","logger":"kuadrant-operator.controlplane.bootstrap.olm-cleanup","msg":"cleaned OLM metadata","resource":"customresourcedefinitions","name":"limitadors.limitador.kuadrant.io"}
{"level":"info","ts":"2026-11-02T00:39:36.589Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Deployment","APIServer","ClusterVersion","GatewayClass"],"eventTypes":{"create":8}}
{"level":"info","ts":"2026-11-02T00:39:36.644Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:39:36.644Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:39:36.644Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:39:36.644Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:39:36.644Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"creating network policy"}
{"level":"info","ts":"2026-11-02T00:39:36.645Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:39:36.645Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:39:36.645Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:39:36.645Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:39:36.700Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:39:36.700Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"creating network policy"}
{"level":"info","ts":"2026-11-02T00:39:36.754Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:39:36.754Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:39:36.754Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:39:39.571Z","logger":"kuadrant-operator.controlplane.reconciler","msg":"component installed","component":"dns-operator","version":"0.18.0"}
{"level":"info","ts":"2026-11-02T00:39:39.571Z","logger":"kuadrant-operator.controlplane.reconciler","msg":"component installed","component":"mcp-gateway","version":"1.0.2"}
{"level":"info","ts":"2026-11-02T00:39:39.571Z","logger":"kuadrant-operator.controlplane.reconciler","msg":"component installed","component":"authorino-operator","version":"0.27.0"}
{"level":"info","ts":"2026-11-02T00:39:39.571Z","logger":"kuadrant-operator.controlplane.reconciler","msg":"component installed","component":"limitador-operator","version":"0.19.0"}
{"level":"info","ts":"2026-11-02T00:39:39.571Z","logger":"kuadrant-operator.controlplane.reconciler","msg":"component installed","component":"developer-portal-controller","version":"0.3.1"}
{"level":"info","ts":"2026-11-02T00:39:39.571Z","logger":"kuadrant-operator.controlplane.reconciler","msg":"reconciling KuadrantControlPlane","name":"default"}
{"level":"info","ts":"2026-11-02T00:39:40.420Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Deployment","ConfigMap","NetworkPolicy"],"eventTypes":{"create":5}}
{"level":"info","ts":"2026-11-02T00:39:40.477Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:39:40.477Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:39:40.477Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:39:40.477Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:39:40.477Z","logger":"kuadrant-operator.ConsolePluginReconciler","msg":"create object","kind":"v1.NetworkPolicy","name":"kuadrant-console-plugin","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:39:40.477Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"creating network policy"}
{"level":"info","ts":"2026-11-02T00:39:40.530Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:39:40.530Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:39:40.531Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"creating network policy"}
{"level":"info","ts":"2026-11-02T00:39:40.533Z","logger":"kuadrant-operator.ConsolePluginReconciler","msg":"create object","kind":"v1.Service","name":"kuadrant-console-plugin","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:39:40.584Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:39:40.584Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:39:40.591Z","logger":"kuadrant-operator.ConsolePluginReconciler","msg":"create object","kind":"v1.Deployment","name":"kuadrant-console-plugin","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:39:40.653Z","logger":"kuadrant-operator.ConsolePluginReconciler","msg":"create object","kind":"v1.ConsolePlugin","name":"kuadrant-console-plugin","namespace":""}
{"level":"info","ts":"2026-11-02T00:39:44.186Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","NetworkPolicy","ConsolePlugin"],"eventTypes":{"create":4,"update":1}}
{"level":"info","ts":"2026-11-02T00:39:44.243Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:39:44.243Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:39:44.243Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:39:44.243Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:39:44.243Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:39:44.243Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:39:44.243Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:39:44.243Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:39:44.463Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Deployment"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T00:39:44.517Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:39:44.517Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:39:44.517Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:39:44.517Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:39:44.517Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:39:44.517Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:39:44.517Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:39:44.517Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:39:52.592Z","logger":"kuadrant-operator.controlplane.reconciler","msg":"reconciling KuadrantControlPlane","name":"default"}
{"level":"info","ts":"2026-11-02T00:39:57.241Z","logger":"kuadrant-operator.controlplane.reconciler","msg":"reconciling KuadrantControlPlane","name":"default"}
{"level":"info","ts":"2026-11-02T00:40:01.534Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Deployment","Issuer","Kuadrant","ConfigMap"],"eventTypes":{"create":2,"update":4}}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"error","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciliation error","error":"provided resoucre has nil Object"}
{"level":"error","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciliation error","error":"provided resoucre has nil Object"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:01.590Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:40:01.643Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"created authorino resource","status":"acceptable"}
{"level":"info","ts":"2026-11-02T00:40:01.644Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:40:01.644Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:01.644Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:01.703Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:01.704Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway","GatewayClass"],"eventTypes":{"create":3}}
{"level":"info","ts":"2026-11-02T00:40:01.760Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"error","ts":"2026-11-02T00:40:01.760Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciliation error","error":"provided resoucre has nil Object"}
{"level":"error","ts":"2026-11-02T00:40:01.760Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciliation error","error":"provided resoucre has nil Object"}
{"level":"info","ts":"2026-11-02T00:40:01.760Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:01.760Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:01.760Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:01.760Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:01.761Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:01.761Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:01.761Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:01.767Z","logger":"kuadrant-operator.controlplane.reconciler","msg":"reconciling KuadrantControlPlane","name":"default"}
{"level":"error","ts":"2026-11-02T00:40:01.813Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"updateKuadrantStatusError","status":"error","error":"Operation cannot be fulfilled on kuadrants.kuadrant.io \"kuadrant\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:40:01.814Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"Failed to update status: resource might just be outdated","status":"error"}
{"level":"info","ts":"2026-11-02T00:40:01.814Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:05.451Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Authorino","Deployment","Kuadrant","ConfigMap","ClusterVersion","Limitador"],"eventTypes":{"create":4,"update":3}}
{"level":"info","ts":"2026-11-02T00:40:05.507Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:05.507Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:05.507Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:05.507Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"creating network policy"}
{"level":"info","ts":"2026-11-02T00:40:05.507Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"update object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"update object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:05.508Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:05.563Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"creating network policy"}
{"level":"info","ts":"2026-11-02T00:40:05.563Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:40:05.563Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:05.567Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:40:05.616Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:05.718Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:05.772Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:05.773Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Deployment","Authorino"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:40:05.828Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:05.828Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"creating network policy"}
{"level":"info","ts":"2026-11-02T00:40:05.828Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:05.829Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:05.829Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:40:05.829Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:05.829Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:05.829Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:05.829Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"error","ts":"2026-11-02T00:40:05.882Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"failed to create NetworkPolicy object","networkPolicy":{"metadata":{"labels":{"app":"kuadrant","app.kubernetes.io/component":"kuadrant","app.kubernetes.io/instance":"kuadrant","app.kubernetes.io/managed-by":"kuadrant-operator","app.kubernetes.io/name":"kuadrant","app.kubernetes.io/part-of":"kuadrant"},"name":"kuadrant-authorino","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"operator.authorino.kuadrant.io/v1beta1","blockOwnerDeletion":false,"controller":true,"kind":"Authorino","name":"authorino","uid":"eb735d15-fe4a-4807-8f4e-d7208123f467"}]},"spec":{"ingress":[{"ports":[{"port":8083,"protocol":"TCP"}]},{"ports":[{"port":8080,"protocol":"TCP"}]},{"from":[{"namespaceSelector":{"matchLabels":{"kubernetes.io/metadata.name":"openshift-ingress"}}}],"ports":[{"port":50051,"protocol":"TCP"}]},{"from":[{"namespaceSelector":{"matchLabels":{"kubernetes.io/metadata.name":"openshift-ingress"}}}],"ports":[{"port":5001,"protocol":"TCP"}]}],"podSelector":{"matchLabels":{"authorino-resource":"authorino","control-plane":"controller-manager"}},"policyTypes":["Ingress"]}},"error":"networkpolicies.networking.k8s.io \"kuadrant-authorino\" already exists"}
{"level":"error","ts":"2026-11-02T00:40:05.882Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"failed to write authorino network policy to cluster","error":"networkpolicies.networking.k8s.io \"kuadrant-authorino\" already exists"}
{"level":"info","ts":"2026-11-02T00:40:05.882Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:40:05.882Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"creating network policy"}
{"level":"error","ts":"2026-11-02T00:40:05.935Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"failed to create NetworkPolicy object","networkPolicy":{"metadata":{"labels":{"app":"kuadrant","app.kubernetes.io/component":"kuadrant","app.kubernetes.io/instance":"kuadrant","app.kubernetes.io/managed-by":"kuadrant-operator","app.kubernetes.io/name":"kuadrant","app.kubernetes.io/part-of":"kuadrant"},"name":"kuadrant-limitador","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"limitador.kuadrant.io/v1alpha1","blockOwnerDeletion":false,"controller":true,"kind":"Limitador","name":"limitador","uid":"e4338765-e265-4cab-a5d9-30a3ffbc5101"}]},"spec":{"ingress":[{"ports":[{"port":8080,"protocol":"TCP"}]},{"from":[{"namespaceSelector":{"matchLabels":{"kubernetes.io/metadata.name":"openshift-ingress"}}}],"ports":[{"port":8081,"protocol":"TCP"}]}],"podSelector":{"matchLabels":{"app":"limitador","app.kubernetes.io/component":"limitador","app.kubernetes.io/instance":"limitador","app.kubernetes.io/managed-by":"limitador-operator","app.kubernetes.io/name":"limitador","app.kubernetes.io/part-of":"kuadrant","limitador-resource":"limitador"}},"policyTypes":["Ingress"]}},"error":"networkpolicies.networking.k8s.io \"kuadrant-limitador\" already exists"}
{"level":"error","ts":"2026-11-02T00:40:05.935Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"failed to write limitador network policy to cluster","error":"networkpolicies.networking.k8s.io \"kuadrant-limitador\" already exists"}
{"level":"error","ts":"2026-11-02T00:40:05.935Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciliation error","error":"networkpolicies.networking.k8s.io \"kuadrant-authorino\" already exists"}
{"level":"error","ts":"2026-11-02T00:40:05.935Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciliation error","error":"networkpolicies.networking.k8s.io \"kuadrant-limitador\" already exists"}
{"level":"info","ts":"2026-11-02T00:40:05.935Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:05.935Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-11-02T00:40:05.987Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"updateKuadrantStatusError","status":"error","error":"Operation cannot be fulfilled on kuadrants.kuadrant.io \"kuadrant\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:40:05.987Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"Failed to update status: resource might just be outdated","status":"error"}
{"level":"info","ts":"2026-11-02T00:40:05.987Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:09.536Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","NetworkPolicy","GatewayClass","Authorino","HTTPRoute","ConfigMap","Deployment","Issuer","Kuadrant"],"eventTypes":{"create":2,"update":9}}
{"level":"info","ts":"2026-11-02T00:40:09.592Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:09.593Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:09.594Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:09.594Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:09.594Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:09.647Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:40:09.647Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:09.647Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:40:09.702Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:09.702Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:09.702Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:13.395Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","NetworkPolicy","Deployment"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-11-02T00:40:13.451Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:13.451Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:13.451Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:13.451Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:40:13.451Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:13.451Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:13.451Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:13.451Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:13.452Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Authorino","Deployment","Gateway"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T00:40:13.508Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:13.508Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:13.509Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:13.561Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:40:13.561Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:13.561Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:17.155Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T00:40:17.212Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T00:40:17.268Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:17.268Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:17.268Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:40:17.268Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:17.268Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:17.268Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:17.268Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:17.268Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:17.268Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:23.025Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Deployment","ConfigMap","Limitador"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T00:40:23.081Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:23.082Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:23.081Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:23.082Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:40:23.082Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:23.082Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:23.082Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:40:23.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:23.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:40:23.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:23.082Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:23.082Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:23.083Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:23.083Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:23.135Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:40:23.135Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:23.135Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:23.191Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:33.428Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Deployment","ConfigMap","Gateway","Kuadrant"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:40:33.485Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:33.486Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:33.486Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:40:33.486Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:33.486Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:33.486Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:40:33.538Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:40:33.538Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:40:33.539Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:40:33.539Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:40:33.539Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:01.226Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T00:41:01.283Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:01.283Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:01.283Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:03.327Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","Gateway"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T00:41:03.384Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:03.384Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:03.384Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:41:03.384Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:03.384Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:03.384Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:03.384Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:03.467Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:03.467Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:11.198Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:41:11.255Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:11.255Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:11.255Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:41:11.255Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:11.255Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:11.255Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:11.255Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:11.370Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:11.370Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:23.935Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","ConfigMap"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T00:41:23.991Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:23.992Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:23.992Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:26.046Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","AuthPolicy"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T00:41:26.102Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:26.102Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:26.102Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:41:26.102Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:26.102Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:26.102Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:26.102Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:26.223Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:26.223Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:36Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry","reconcileID":"c1400a6c-4976-4d22-b4bc-84adf9bfd239","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T00:41:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry","event":"CREATE"}
{"level":"info","ts":"2026-11-02T00:41:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry","reconcileID":"dcabbdab-0bff-42be-b2ca-305fb2cbba57","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry","reconcileID":"b8c1ac5d-b59b-444a-a3e5-9d87d9a78130","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T00:41:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T00:41:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T00:41:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T00:41:38Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T00:41:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T00:41:38.361Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-11-02T00:41:38.419Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:38.419Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:38.419Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:38.421Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:38.421Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:41:38.422Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:38.523Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:38.964Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:38.964Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:39.139Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-11-02T00:41:39.197Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:39.197Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:41:39.198Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:39.198Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T00:41:39.249Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:39.250Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:41:39.251Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","outlier_detection":{"enforcing_consecutive_gateway_failure":100,"max_ejection_percent":100},"type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-maas-default-gateway\" already exists"}
{"level":"error","ts":"2026-11-02T00:41:39.281Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\" already exists"}
{"level":"error","ts":"2026-11-02T00:41:39.334Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny","namespace":"openshift-ingress","uid":"7047b220-647e-4fb9-9b7a-e96a35c50211","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:41:39.389Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:41:39.500Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:39.500Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"LimitadorLimitsReconciler","operation":"update","resource":"kuadrant-system/limitador","kind":"Limitador.limitador.kuadrant.io","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:39.500Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioRateLimitClusterReconciler","operation":"create","resource":"openshift-ingress/kuadrant-ratelimiting-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-maas-default-gateway\" already exists"}
{"level":"info","ts":"2026-11-02T00:41:39.500Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"create","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\" already exists"}
{"level":"info","ts":"2026-11-02T00:41:39.500Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":3,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:41:41.500Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":3}
{"level":"info","ts":"2026-11-02T00:41:45.085Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","AuthPolicy","TokenRateLimitPolicy","EnvoyFilter","Limitador","Kuadrant","ConfigMap","Gateway"],"eventTypes":{"create":9,"update":7}}
{"level":"info","ts":"2026-11-02T00:41:45.141Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:45.143Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:45.143Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:41:45.143Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:45.144Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:45.145Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:45.145Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:45.146Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:45.146Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:41:45.146Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:45.147Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:45.196Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:41:45.196Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:41:45.196Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:45.403Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:45.403Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:45.575Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"Limitador.limitador.kuadrant.io/kuadrant-system/limitador/update","attempts":1,"duration":6.074295875}
{"level":"info","ts":"2026-11-02T00:41:45.575Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-ratelimiting-maas-default-gateway/create","attempts":1,"duration":6.074317418}
{"level":"info","ts":"2026-11-02T00:41:45.575Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/create","attempts":1,"duration":6.074317136}
{"level":"info","ts":"2026-11-02T00:41:45.576Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-11-02T00:41:45.635Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:45.635Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:41:45.635Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:45.635Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:45.635Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T00:41:45.757Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:41:38Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"16111","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:41:45.810Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny","namespace":"openshift-ingress","uid":"7047b220-647e-4fb9-9b7a-e96a35c50211","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:45.982Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:45.982Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:41:47.729Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T00:41:47.912Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/update","attempts":1,"duration":1.93017922}
{"level":"info","ts":"2026-11-02T00:41:47.914Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","ConfigMap","AuthPolicy","EnvoyFilter"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T00:41:47.974Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:47.974Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:41:47.974Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:47.974Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:47.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:47.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:47.983Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":0}
{"level":"error","ts":"2026-11-02T00:41:48.236Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:48.424Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/maas-gateway-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:48.424Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:41:50.425Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":1}
{"level":"info","ts":"2026-11-02T00:41:54.060Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Authorino","ConfigMap","Deployment","AuthPolicy"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T00:41:54.119Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:54.120Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:54.120Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:54.120Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:54.120Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:54.120Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:41:54.120Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:54.120Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:54.121Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:54.123Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:54.123Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:54.177Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:41:54.384Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:54.384Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:54.555Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/maas-gateway-auth/update","attempts":1,"duration":6.130680592}
{"level":"info","ts":"2026-11-02T00:41:54.556Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","ConfigMap","AuthPolicy","EnvoyFilter"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T00:41:54.621Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:54.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:54.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:54.622Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:54.622Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:41:54.622Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:41:54.742Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:41:48Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"16317","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:41:54.866Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:55.035Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:55.035Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/maas-gateway-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:55.035Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":2,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:41:56.886Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Deployment"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T00:41:56.942Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:56.942Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:56.942Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:56.942Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:41:56.942Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:56.942Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:56.942Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:56.943Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:57.036Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":2}
{"level":"info","ts":"2026-11-02T00:41:57.070Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/update","attempts":1,"duration":2.034971595}
{"level":"info","ts":"2026-11-02T00:41:57.070Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/maas-gateway-auth/update","attempts":1,"duration":2.034964851}
{"level":"info","ts":"2026-11-02T00:41:57.072Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Deployment","AuthConfig","EnvoyFilter","Authorino","AuthPolicy","ConfigMap"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-11-02T00:41:57.129Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:57.131Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:57.131Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:57.131Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:41:57.131Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:57.131Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:57.131Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:57.131Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:57.133Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:57.134Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:57.134Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:57.184Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"error","ts":"2026-11-02T00:41:57.379Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:57.380Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:57.380Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:57.551Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/maas-gateway-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:41:57.551Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:41:59.342Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","ConfigMap","AuthPolicy","EnvoyFilter"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T00:41:59.400Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:59.401Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:59.401Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:59.401Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:59.401Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:41:59.401Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:59.552Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":1}
{"level":"info","ts":"2026-11-02T00:41:59.830Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/maas-gateway-auth/update","attempts":1,"duration":2.278316884}
{"level":"info","ts":"2026-11-02T00:41:59.832Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","Deployment","AuthPolicy","ConfigMap"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-11-02T00:41:59.889Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:59.890Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:59.890Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:59.890Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:59.890Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:59.890Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:41:59.890Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:41:59.890Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:41:59.892Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:41:59.892Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:41:59.892Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T00:42:00.014Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:41:57Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"16679","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:42:00.072Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:42:00.300Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:42:00.300Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/maas-gateway-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:42:00.300Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":2,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:42:02.300Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":2}
{"level":"info","ts":"2026-11-02T00:42:03.798Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Deployment","AuthConfig","EnvoyFilter","Authorino","AuthPolicy","ConfigMap"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-11-02T00:42:03.856Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:03.856Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:03.856Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:03.856Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:42:03.856Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:42:03.856Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:42:03.856Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:42:03.856Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:03.857Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:42:03.858Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:03.858Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:03.909Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:42:04.114Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:04.114Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:04.285Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/update","attempts":1,"duration":3.984565786}
{"level":"info","ts":"2026-11-02T00:42:04.285Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/maas-gateway-auth/update","attempts":1,"duration":3.984576118}
{"level":"info","ts":"2026-11-02T00:42:04.289Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","AuthConfig","EnvoyFilter"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T00:42:04.348Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:42:04.349Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:04.349Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T00:42:04.471Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:41:59Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"16779","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:42:04.589Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:42:04.760Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/maas-gateway-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:42:04.760Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:42:04.760Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":2,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:42:04.762Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","Deployment","AuthPolicy","ConfigMap"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-11-02T00:42:04.818Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:04.820Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:04.820Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:04.820Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:42:04.820Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:42:04.820Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:42:04.820Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:42:04.820Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:04.821Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:42:04.821Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:04.821Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T00:42:04.947Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:41:59Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"16779","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:42:05.006Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:42:05.237Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":2,"requeueAfter":4}
{"level":"info","ts":"2026-11-02T00:42:07.037Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter","AuthPolicy"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T00:42:07.097Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:42:07.098Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:07.098Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:07.520Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/update","attempts":2,"duration":2.75913145}
{"level":"info","ts":"2026-11-02T00:42:07.520Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/maas-gateway-auth/update","attempts":2,"duration":2.75918975}
{"level":"info","ts":"2026-11-02T00:42:09.237Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":0}
{"level":"info","ts":"2026-11-02T00:42:09.284Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:09.342Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:09.342Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:11.338Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:11.396Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:11.396Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:13.389Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:13.447Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:13.447Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:15.448Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:15.507Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:15.507Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:17.499Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:17.557Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:17.557Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:19.542Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:19.599Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:19.599Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:21.586Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:21.644Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:21.644Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:23.652Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:23.713Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:23.713Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:25.710Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:25.768Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:25.768Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:27.769Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:27.827Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:27.827Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:29.820Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:29.877Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:29.877Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:31.871Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:31.929Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:31.929Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:33.926Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:33.986Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:33.986Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:35.974Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:36.031Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:36.031Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:38.020Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:38.078Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:38.078Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:40.120Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:40.179Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:40.179Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:42.189Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:42.247Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:42.247Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:44.246Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:44.304Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:44.304Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:46.294Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:46.352Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:46.352Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:48.348Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:48.406Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:48.406Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:50.406Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:50.465Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:50.465Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:52.451Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:52.509Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:52.509Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:54.595Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:54.653Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:54.653Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:56.690Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:56.750Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:56.750Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:42:58.847Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:42:58.906Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:42:58.906Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:00.949Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:01.008Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:01.008Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:03.000Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:03.058Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:03.058Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:05.099Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:05.158Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:05.158Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:07.158Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:07.216Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:07.216Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:09.210Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:09.269Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:09.269Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:11.262Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:11.322Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:11.322Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:13.411Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:13.469Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:13.470Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:15.515Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:15.576Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:15.576Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:17.571Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:17.629Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:17.629Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:19.633Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:19.691Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:19.691Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:21.686Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:21.745Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:21.745Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:23.795Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:23.853Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:23.853Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:25.871Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:25.930Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:25.930Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:27.922Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:27.980Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:27.980Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:29.976Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:30.035Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:30.035Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:32.036Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:32.096Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:32.096Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:34.090Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:34.148Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:34.148Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:36.136Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:36.194Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:36.194Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:38.186Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:38.245Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:38.245Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:40.239Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:40.298Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:40.298Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:42.309Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:42.369Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:42.369Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:44.364Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:44.423Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:44.423Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:46.419Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:46.477Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:46.478Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:48.475Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:48.534Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:48.534Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:43:50.559Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:43:50.617Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:43:50.617Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:10.691Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T00:44:10.749Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:10.749Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:10.749Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:15.149Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap","AuthPolicy","EnvoyFilter"],"eventTypes":{"update":9}}
{"level":"info","ts":"2026-11-02T00:44:15.214Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:15.215Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:15.215Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:16.315Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T00:44:16.379Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:16.380Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:16.380Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:16.382Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:16.382Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:44:16.383Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:16.439Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:16.443Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:16.505Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:16.566Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:16.600Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":58,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:10Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"18630","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:16.628Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:16.689Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:16.750Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:16.813Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:16.877Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-publisher-path-catch-all"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:16.938Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:17.000Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:17.064Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:17.127Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:17.246Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:17.246Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:17.246Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:17.302Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-distinct-2-simulated-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-distinct-2-simulated-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/maas-gateway-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:17.416Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":14,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:44:19.416Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":14}
{"level":"info","ts":"2026-11-02T00:44:21.148Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Limitador","TokenRateLimitPolicy","EnvoyFilter","HTTPRoute","AuthPolicy","ConfigMap"],"eventTypes":{"create":12,"update":6}}
{"level":"info","ts":"2026-11-02T00:44:21.206Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:21.206Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:21.208Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:44:21.208Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:21.216Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:21.216Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:21.217Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:44:21.217Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:21.217Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:21.218Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:21.262Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:44:21.262Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:21.274Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:22.107Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:22.107Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14/create","attempts":1,"duration":4.863922131}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933/create","attempts":1,"duration":4.864008912}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72/create","attempts":1,"duration":4.864005327}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57/create","attempts":1,"duration":4.863995512}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe/create","attempts":1,"duration":4.864011624}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef/create","attempts":1,"duration":4.864006901}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2/create","attempts":1,"duration":4.864002438}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce/create","attempts":1,"duration":4.864002805}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a/create","attempts":1,"duration":4.864092089}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c/create","attempts":1,"duration":4.864075115}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/maas-gateway-auth/update","attempts":1,"duration":4.864069099}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/update","attempts":1,"duration":4.864063468}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e/create","attempts":1,"duration":4.864063007}
{"level":"info","ts":"2026-11-02T00:44:22.280Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96/create","attempts":1,"duration":4.864051388}
{"level":"info","ts":"2026-11-02T00:44:22.288Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T00:44:22.361Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:22.362Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:22.362Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:22.363Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:22.363Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:44:22.364Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T00:44:22.416Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:22.416Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:22.423Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:22.485Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:22.547Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:22.609Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:22.641Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":59,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:15Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"18819","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:22.671Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:22.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:22.795Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:22.857Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:22.919Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:22.981Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:23.043Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:23.105Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:23.225Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:23.225Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:23.225Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:23.281Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-distinct-simulated-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-distinct-simulated-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/maas-gateway-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"LimitadorLimitsReconciler","operation":"update","resource":"kuadrant-system/limitador","kind":"Limitador.limitador.kuadrant.io","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:23.394Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":15,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:44:23.397Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T00:44:23.471Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:23.471Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:23.472Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:44:23.473Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:23.473Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:23.473Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:23.524Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:23.524Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:23.538Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:23.626Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:23.692Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:23.755Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:23.812Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":59,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:15Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"18819","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:23.818Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:23.880Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:23.943Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:24.005Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:24.071Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:24.134Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:24.197Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:24.259Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:24.378Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:24.378Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:24.378Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:24.433Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:24.437Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-distinct-simulated-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-distinct-simulated-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:24.545Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":15,"requeueAfter":4}
{"level":"info","ts":"2026-11-02T00:44:28.368Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","Gateway","ConfigMap","HTTPRoute","AuthPolicy","Limitador"],"eventTypes":{"create":13,"update":6}}
{"level":"info","ts":"2026-11-02T00:44:28.433Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:28.433Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:28.438Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:28.439Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:44:28.466Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:28.466Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:28.466Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:28.468Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:28.469Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:44:28.470Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:28.492Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:44:28.492Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:28.523Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:28.545Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":15}
{"level":"info","ts":"2026-11-02T00:44:30.162Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:30.162Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:30.329Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984/create","attempts":2,"duration":6.935365764}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/update","attempts":2,"duration":6.935328148}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381/create","attempts":2,"duration":6.935354239}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad/create","attempts":2,"duration":6.935330106}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95/create","attempts":2,"duration":6.935324366}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71/create","attempts":2,"duration":6.935314094}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf/create","attempts":2,"duration":6.935304488}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3/create","attempts":2,"duration":6.935300762}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/maas-gateway-auth/update","attempts":2,"duration":6.935367825}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688/create","attempts":2,"duration":6.935359442}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84/create","attempts":2,"duration":6.935333896}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40/create","attempts":2,"duration":6.935326658}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58/create","attempts":2,"duration":6.93537836}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668/create","attempts":2,"duration":6.935365459}
{"level":"info","ts":"2026-11-02T00:44:30.330Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"Limitador.limitador.kuadrant.io/kuadrant-system/limitador/update","attempts":2,"duration":6.935361595}
{"level":"info","ts":"2026-11-02T00:44:30.338Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T00:44:30.437Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:30.438Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:30.438Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:30.440Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:30.441Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:44:30.442Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T00:44:30.495Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:30.495Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:30.501Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:30.564Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:30.625Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:30.695Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:30.798Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-publisher-path-catch-all"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:30.862Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:30.923Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:30.985Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.047Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.109Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.122Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":60,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:21Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"18968","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:31.172Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.233Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.295Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.359Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.421Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.483Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.545Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.607Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.668Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.731Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.793Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.854Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.917Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:31.979Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-publisher-path-catch-all"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:32.040Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:32.098Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:32.098Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:32.154Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-trlp-test-simulated-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-trlp-test-simulated-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:32.210Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:32.212Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-embedding-simulated-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-embedding-simulated-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/maas-gateway-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"LimitadorLimitsReconciler","operation":"update","resource":"kuadrant-system/limitador","kind":"Limitador.limitador.kuadrant.io","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/a9800464506c58f005016df354e160757732171ff4d19747202524955329b998","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:32.267Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":27,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:44:34.267Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":27}
{"level":"info","ts":"2026-11-02T00:44:34.425Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T00:44:34.620Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:34.621Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:34.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:34.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:34.622Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:44:34.623Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:34.680Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:36.347Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:36.347Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:36.467Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"Limitador.limitador.kuadrant.io/kuadrant-system/limitador/update","attempts":1,"duration":4.261005144}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002/create","attempts":1,"duration":4.261061164}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949/create","attempts":1,"duration":4.261055452}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1/create","attempts":1,"duration":4.261038249}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/update","attempts":1,"duration":4.261030178}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a/create","attempts":1,"duration":4.261024168}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6/create","attempts":1,"duration":4.260982947}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194/create","attempts":1,"duration":4.261112048}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff/create","attempts":1,"duration":4.26108682}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec/create","attempts":1,"duration":4.261082023}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f/create","attempts":1,"duration":4.261064922}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df/create","attempts":1,"duration":4.261056101}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/a9800464506c58f005016df354e160757732171ff4d19747202524955329b998/create","attempts":1,"duration":4.261046429}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c/create","attempts":1,"duration":4.261125976}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/maas-gateway-auth/update","attempts":1,"duration":4.261124527}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e/create","attempts":1,"duration":4.261089836}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f/create","attempts":1,"duration":4.261054315}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25/create","attempts":1,"duration":4.261047332}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a/create","attempts":1,"duration":4.261032305}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398/create","attempts":1,"duration":4.261179376}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7/create","attempts":1,"duration":4.26111146}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33/create","attempts":1,"duration":4.261079579}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa/create","attempts":1,"duration":4.261068279}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e/create","attempts":1,"duration":4.261062205}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff/create","attempts":1,"duration":4.261060303}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b/create","attempts":1,"duration":4.261058979}
{"level":"info","ts":"2026-11-02T00:44:36.528Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5/create","attempts":1,"duration":4.261171764}
{"level":"info","ts":"2026-11-02T00:44:36.538Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T00:44:36.761Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:36.761Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:36.762Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:36.762Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:36.763Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:44:36.765Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T00:44:36.822Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:36.822Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:36.831Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:36.902Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.003Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.100Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.163Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.227Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.290Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.353Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.424Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.489Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.552Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.617Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.627Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":61,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:28Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19178","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:37.685Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.747Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.812Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.876Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:37.939Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:38.003Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:38.066Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:38.131Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:38.194Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:38.259Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:38.321Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:38.386Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:38.512Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:38.512Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:38.512Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:38.577Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"echo-simulator-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"echo-simulator-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:38.633Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:38.636Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"LimitadorLimitsReconciler","operation":"update","resource":"kuadrant-system/limitador","kind":"Limitador.limitador.kuadrant.io","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/maas-gateway-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:38.690Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":27,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:44:38.712Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthConfig","HTTPRoute","Limitador","AuthPolicy","EnvoyFilter","Gateway"],"eventTypes":{"create":26,"update":7}}
{"level":"info","ts":"2026-11-02T00:44:38.771Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:38.779Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:38.779Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:38.779Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:44:38.915Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:44:38.915Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:38.944Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:38.945Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:38.947Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:44:38.947Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:38.947Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:38.947Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T00:44:39.003Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:39.003Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:39.007Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.068Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.128Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.188Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.250Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.323Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.385Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.448Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.545Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.612Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.656Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":61,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:28Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19178","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:39.677Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.744Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.807Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.871Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:39.938Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:40.006Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:40.071Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:40.137Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:40.204Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:40.267Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:40.331Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:40.394Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:40.459Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:40.522Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:40.643Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:40.644Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:40.644Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:40.690Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":27}
{"level":"error","ts":"2026-11-02T00:44:40.706Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:40.772Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:40.777Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"echo-simulator-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"echo-simulator-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:40.828Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":27,"requeueAfter":4}
{"level":"info","ts":"2026-11-02T00:44:42.999Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T00:44:43.309Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:43.309Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:43.310Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:44:43.310Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:43.310Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:43.312Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:43.368Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:44.240Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":62,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19433","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:44:44.828Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":27}
{"level":"info","ts":"2026-11-02T00:44:45.037Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:45.037Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857/create","attempts":2,"duration":6.519244392}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce/create","attempts":2,"duration":6.519260461}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714/create","attempts":2,"duration":6.519259813}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455/create","attempts":2,"duration":6.519259317}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0/create","attempts":2,"duration":6.519378192}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea/create","attempts":2,"duration":6.51936929}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f/create","attempts":2,"duration":6.519367363}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74/create","attempts":2,"duration":6.519359415}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/maas-gateway-auth/update","attempts":2,"duration":6.519356253}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0/create","attempts":2,"duration":6.519342332}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c/create","attempts":2,"duration":6.519334077}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0/create","attempts":2,"duration":6.519332593}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b/create","attempts":2,"duration":6.51938123}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600/create","attempts":2,"duration":6.519329787}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3/create","attempts":2,"duration":6.51930899}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a/create","attempts":2,"duration":6.519293425}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed/create","attempts":2,"duration":6.519445313}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"Limitador.limitador.kuadrant.io/kuadrant-system/limitador/update","attempts":2,"duration":6.519412947}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340/create","attempts":2,"duration":6.519382589}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796/create","attempts":2,"duration":6.519376861}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b/create","attempts":2,"duration":6.519370861}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6/create","attempts":2,"duration":6.519358212}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5/create","attempts":2,"duration":6.51935217}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724/create","attempts":2,"duration":6.519350795}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac/create","attempts":2,"duration":6.519445738}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061/create","attempts":2,"duration":6.519398532}
{"level":"info","ts":"2026-11-02T00:44:45.209Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":8}
{"level":"info","ts":"2026-11-02T00:44:45.233Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthConfig","Gateway","Limitador","TokenRateLimitPolicy","ConfigMap","AuthPolicy","EnvoyFilter"],"eventTypes":{"create":28,"update":7}}
{"level":"info","ts":"2026-11-02T00:44:45.311Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:45.312Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:45.312Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:45.312Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:44:45.412Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:44:45.412Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:45.426Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:45.427Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:45.427Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:45.428Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:45.430Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T00:44:45.430Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T00:44:45.495Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:45.495Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:45.496Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:45.605Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:45.668Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:45.730Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:45.793Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:45.856Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:45.920Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:45.982Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.045Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.107Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.170Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.232Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.294Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.358Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.354Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":62,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19433","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"error","ts":"2026-11-02T00:44:46.421Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.484Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.548Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.611Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-publisher-path-catch-all"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.673Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.736Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.798Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.860Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.922Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:46.987Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","namespace":"kuadrant-system","ownerReferences":[{"apiVersion":"kuadrant.io/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"Kuadrant","name":"kuadrant","uid":"6f8d0c14-c478-4a56-bd15-bbc305524a12"}]},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/060e2"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","version":"v0"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","version":"v0"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\" already exists"}
{"level":"error","ts":"2026-11-02T00:44:47.041Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"717ce606-367e-49fc-a255-dfbb1653d3d8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:47.095Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"d8547073-6a12-4f3e-8910-1cdef231c342","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:47.111Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:47.150Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:47.151Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:47.210Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-simulated-simulated-premium-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"premium-simulated-simulated-premium-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T00:44:47.272Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"facebook-opt-125m-simulated-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"facebook-opt-125m-simulated-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"LimitadorLimitsReconciler","operation":"update","resource":"kuadrant-system/limitador","kind":"Limitador.limitador.kuadrant.io","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthPolicyStatusUpdater","operation":"update","resource":"openshift-ingress/maas-gateway-auth","kind":"AuthPolicy.kuadrant.io","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"AuthConfigsReconciler","operation":"create","resource":"kuadrant-system/0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","kind":"AuthConfig.authorino.kuadrant.io","error":"authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\" already exists"}
{"level":"info","ts":"2026-11-02T00:44:47.325Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":27,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:44:49.326Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":27}
{"level":"info","ts":"2026-11-02T00:44:49.636Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","Limitador","ConfigMap","AuthPolicy","HTTPRoute"],"eventTypes":{"create":24,"update":7}}
{"level":"info","ts":"2026-11-02T00:44:49.697Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:49.697Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:49.728Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:49.746Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:44:49.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:44:49.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:49.899Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:49.903Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:49.903Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:49.904Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:44:49.904Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:49.905Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:49.899Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T00:44:50.810Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":62,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19433","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:44:50.994Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:50.995Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3/create","attempts":1,"duration":3.843055173}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"Limitador.limitador.kuadrant.io/kuadrant-system/limitador/update","attempts":1,"duration":3.843036819}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4/create","attempts":1,"duration":3.843035497}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0/create","attempts":1,"duration":3.84301656}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264/create","attempts":1,"duration":3.842999641}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045/create","attempts":1,"duration":3.84298742}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b/create","attempts":1,"duration":3.842955841}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c/create","attempts":1,"duration":3.842950721}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc/create","attempts":1,"duration":3.843057333}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7/create","attempts":1,"duration":3.843048786}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd/create","attempts":1,"duration":3.84301735}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5/create","attempts":1,"duration":3.843000842}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de/create","attempts":1,"duration":3.842998214}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13/create","attempts":1,"duration":3.842982996}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb/create","attempts":1,"duration":3.842975626}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40/create","attempts":1,"duration":3.843060402}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9/create","attempts":1,"duration":3.843058809}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630/create","attempts":1,"duration":3.843054737}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c/create","attempts":1,"duration":3.843011486}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthPolicy.kuadrant.io/openshift-ingress/maas-gateway-auth/update","attempts":1,"duration":3.843010475}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5/create","attempts":1,"duration":3.84298505}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb/create","attempts":1,"duration":3.842983551}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0/create","attempts":1,"duration":3.843060519}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04/create","attempts":1,"duration":3.843048833}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07/create","attempts":1,"duration":3.843045369}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"AuthConfig.authorino.kuadrant.io/kuadrant-system/f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6/create","attempts":1,"duration":3.84300471}
{"level":"info","ts":"2026-11-02T00:44:51.168Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":32}
{"level":"info","ts":"2026-11-02T00:44:53.468Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthConfig","Gateway","Limitador","TokenRateLimitPolicy","ConfigMap","AuthPolicy","EnvoyFilter"],"eventTypes":{"create":28,"update":7}}
{"level":"info","ts":"2026-11-02T00:44:53.534Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:53.553Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:53.553Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:53.553Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:44:53.640Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:44:53.640Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:53.722Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:53.723Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:53.723Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:53.731Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:53.732Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:44:53.732Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:53.733Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T00:44:54.741Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":62,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19433","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:44:54.915Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:54.915Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:55.086Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"max retry attempts reached, giving up","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","attempts":5,"duration":16.396270351,"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:44:55.086Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"all non-blocking errors have exceeded max retry attempts","errorCount":0}
{"level":"info","ts":"2026-11-02T00:44:55.113Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthConfig","HTTPRoute","Limitador","AuthPolicy","EnvoyFilter","Gateway"],"eventTypes":{"create":26,"update":7}}
{"level":"info","ts":"2026-11-02T00:44:55.190Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:55.241Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:55.241Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T00:44:55.400Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:44:55.400Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:55.422Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:55.539Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:55.541Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:55.542Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:44:55.542Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:55.544Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:55.544Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:55.548Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T00:44:56.603Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":62,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19433","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:44:56.784Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:56.784Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:56.960Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:44:56.960Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:44:56.987Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","AuthPolicy"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T00:44:57.303Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:44:57.311Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:57.312Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:44:57.312Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:44:57.312Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:44:57.312Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T00:44:58.118Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":62,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19433","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:44:58.460Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":4}
{"level":"info","ts":"2026-11-02T00:45:02.461Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":1}
{"level":"info","ts":"2026-11-02T00:45:02.478Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","AuthPolicy"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T00:45:02.932Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:45:02.937Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:02.937Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:45:02.995Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:02.997Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:45:02.997Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:45:04.033Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":62,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19433","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:45:04.391Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":8}
{"level":"info","ts":"2026-11-02T00:45:06.250Z","logger":"kuadrant-operator.controlplane.reconciler","msg":"reconciling KuadrantControlPlane","name":"default"}
{"level":"info","ts":"2026-11-02T00:45:12.391Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":1}
{"level":"info","ts":"2026-11-02T00:45:12.412Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","AuthPolicy"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T00:45:12.913Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:45:12.914Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:12.914Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:45:12.923Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:12.924Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:45:12.924Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:45:14.016Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":62,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19433","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:45:14.371Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":16}
{"level":"info","ts":"2026-11-02T00:45:30.372Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":1}
{"level":"info","ts":"2026-11-02T00:45:32.979Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Deployment","ConfigMap","Authorino"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T00:45:33.040Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:33.053Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:33.053Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:45:33.053Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:45:33.054Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:45:33.054Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:45:33.054Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:45:33.095Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:45:33.133Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T00:45:33.143Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:45:33.143Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:33.143Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T00:45:33.143Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/update","attempts":4,"duration":36.183602257}
{"level":"info","ts":"2026-11-02T00:45:33.213Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","AuthPolicy"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T00:45:33.424Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:45:33.424Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:33.424Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:45:33.433Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:33.434Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:45:33.434Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T00:45:34.409Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":62,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19433","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:45:34.754Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:45:34.754Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:45:36.754Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":1}
{"level":"info","ts":"2026-11-02T00:45:36.942Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Deployment"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-11-02T00:45:37.002Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:37.011Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:37.011Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"limitador-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:45:37.012Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"authorino-operator"}
{"level":"info","ts":"2026-11-02T00:45:37.012Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"dns-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:45:37.012Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"Processing deployment","deployment":"kuadrant-operator-controller-manager"}
{"level":"info","ts":"2026-11-02T00:45:37.013Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operators","msg":"reconciling networkPolicy resources for operators","status":"completed"}
{"level":"info","ts":"2026-11-02T00:45:37.130Z","logger":"kuadrant-operator.NetworkPolicyReconciler.operands","msg":"reconciling networkPolicy resource","status":"completed"}
{"level":"info","ts":"2026-11-02T00:45:37.428Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/update","attempts":1,"duration":2.673616232}
{"level":"info","ts":"2026-11-02T00:45:37.446Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","AuthPolicy"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T00:45:37.741Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:37.742Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:37.742Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T00:45:37.742Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:45:37.742Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:45:37.741Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T00:45:38.731Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":62,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19433","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:45:39.078Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:45:39.078Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:45:41.078Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":1}
{"level":"info","ts":"2026-11-02T00:45:41.343Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap"],"eventTypes":{"update":27}}
{"level":"info","ts":"2026-11-02T00:45:41.828Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/update","attempts":1,"duration":2.75050744}
{"level":"info","ts":"2026-11-02T00:45:41.845Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","AuthPolicy"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T00:45:42.205Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T00:45:42.206Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:42.207Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T00:45:42.207Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T00:45:42.209Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T00:45:42.209Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T00:45:43.148Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T00:41:38Z","generation":62,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"66163456-40dd-4bd2-aacb-2ca9bbf833ce\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T00:44:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"66163456-40dd-4bd2-aacb-2ca9bbf833ce"}],"resourceVersion":"19433","uid":"efbba773-489d-4022-87ca-bc04f83cf870"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/chat/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/completions\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/responses\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages/\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/messages\\\"\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path == \\\"/v1/me\\\"\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-unconfigured-facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/premium-simulated-simulated-premium\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/chat/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/completions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/responses\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/facebook-opt-125m-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator/v1/messages\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-2-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-embedding-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-trlp-test-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/e2e-distinct-simulated\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/llm/echo-simulator\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/subscriptions\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/health\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/api-keys\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/maas-api/v1\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }] }],\\n    amount: uint(0)\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"odh-ai-gateway-infra/maas-api-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/v1/models\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-2-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model-2\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-distinct-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-distinct-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-embedding-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-embedding-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-trlp-test-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-trlp-test-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-unconfigured-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/echo-simulator-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.deny_all_by_default__6d45535f\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_deny_all_by_default__6d45535f != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/test/e2e-echo-model\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/facebook-opt-125m-simulated-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_100_per_1m__cec148f9\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_100_per_1m__cec148f9 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m\\\")\"]}}, {\"actions\":[{\"isGuard\":false, \"path\":\"kuadrant.internal.response.body\", \"predicate\":\"true\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"store\", \"value\":\"{\\\"model\\\": responseBodyJSON(\\\"/model\\\"), \\\"total_tokens\\\": responseBodyJSON([\\\"/usage/total_tokens\\\", \\\"/usageMetadata/totalTokenCount\\\", \\\"/response/usage/total_tokens\\\", \\\"/usage/totalTokens\\\"], \\\"number\\\")}\"}, {\"isGuard\":true, \"label\":\"auth\", \"messageBuilder\":\"envoy.service.auth.v3.CheckRequest {\\n  attributes: envoy.service.auth.v3.AttributeContext {\\n    request: envoy.service.auth.v3.AttributeContext.Request {\\n      time: request.time,\\n      http: envoy.service.auth.v3.AttributeContext.HttpRequest {\\n        host: request.host,\\n        method: request.method,\\n        scheme: request.scheme,\\n        path: request.path,\\n        protocol: request.protocol,\\n        headers: request.headers\\n      }\\n    },\\n    destination: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: destination.address,\\n          port_value: uint(destination.port)\\n        }\\n      }\\n    },\\n    source: envoy.service.auth.v3.AttributeContext.Peer {\\n      address: envoy.config.core.v3.Address {\\n        socket_address: envoy.config.core.v3.SocketAddress {\\n          address: source.address,\\n          port_value: uint(source.port)\\n        }\\n      }\\n    },\\n    context_extensions: {\\\"host\\\": \\\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\\\"},\\n    metadata_context: envoy.config.core.v3.Metadata{filter_metadata: {\\\"io.kuadrant.metrics.labels\\\": google.protobuf.Struct{fields: {\\\"cost_center\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"organization_id\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\\\\\"\\\\\\\"\\\"}}}}, \\\"subscription\\\": google.protobuf.Value{struct_value: google.protobuf.Struct{fields: {\\\"cel_expr\\\": google.protobuf.Value{string_value: \\\"auth.identity.selected_subscription\\\"}}}}}}}}\\n  }\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: (auth_response.denied_response.status.code != 0) ? uint(auth_response.denied_response.status.code) : 403u, headers: auth_response.denied_response.headers, body: auth_response.denied_response.body}\", \"isGuard\":true, \"predicate\":\"has(auth_response.denied_response)\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"logMessage\":\"Unsupported field in OkHttpResponse\", \"predicate\":\"has(auth_response.ok_response) && (auth_response.ok_response.response_headers_to_add.size() > 0 || auth_response.ok_response.headers_to_remove.size() > 0 || auth_response.ok_response.query_parameters_to_set.size() > 0 || auth_response.ok_response.query_parameters_to_remove.size() > 0)\", \"terminal\":true, \"type\":\"fail\"}, {\"exportToHost\":true, \"isGuard\":true, \"path\":\"auth\", \"predicate\":\"has(auth_response.ok_response) && has(auth_response.dynamic_metadata)\", \"terminal\":false, \"type\":\"store\", \"value\":\"auth_response.dynamic_metadata\"}, {\"headers\":\"auth_response.ok_response.headers\", \"isGuard\":true, \"predicate\":\"has(auth_response.ok_response)\", \"target\":\"request\", \"terminal\":false, \"type\":\"headers\"}, {\"isGuard\":true, \"logMessage\":\"Auth response contained no http_response from auth_response\", \"predicate\":\"!has(auth_response.denied_response) && !has(auth_response.ok_response)\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\", \"service\":\"auth-service\", \"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"auth_response\"}, {\"isGuard\":true, \"label\":\"ratelimit_reserve\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.ReserveRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    amount: uint(0),\\n    ttl: duration(\\\"0s\\\")\\n}\", \"onReply\":[{\"denyWith\":\"DenyResponse{status: 429u, headers: [[\\\"content-type\\\", \\\"application/json\\\"]], body: \\\"{\\\\\\\"error\\\\\\\": {\\\\\\\"message\\\\\\\": \\\\\\\"Too Many Requests\\\\\\\", \\\\\\\"type\\\\\\\": \\\\\\\"rate_limit_exceeded\\\\\\\", \\\\\\\"code\\\\\\\": 429}}\\\"}\", \"isGuard\":true, \"predicate\":\"reserve_response.code == 2\", \"terminal\":true, \"type\":\"deny\"}, {\"isGuard\":true, \"path\":\"kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13\", \"predicate\":\"reserve_response.code == 1 && has(reserve_response.reservation_id)\", \"terminal\":false, \"type\":\"store\", \"value\":\"reserve_response.reservation_id\"}, {\"isGuard\":true, \"logMessage\":\"Unknown reserve response code from reserve_response\", \"predicate\":\"reserve_response.code != 1 && reserve_response.code != 2\", \"terminal\":true, \"type\":\"fail\"}], \"predicate\":\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\", \"service\":\"ratelimit-reserve-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"reserve_response\"}, {\"isGuard\":false, \"label\":\"ratelimit_commit\", \"messageBuilder\":\"kuadrant.service.ratelimit.v1.CommitRequest {\\n    domain: \\\"llm/premium-simulated-simulated-premium-kserve-route\\\",\\n    descriptors: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: ((auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) ? [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"tokenlimit.tokens_1000_per_1m__09f43f13\\\", value: string(1) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.selected_subscription_id\\\", value: string(auth.identity.selected_subscription_id) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"auth.identity.userid\\\", value: string(auth.identity.userid) }] : []) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor { entries: [envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"cost_center\\\", value: string(has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"model\\\", value: string(kuadrant.internal.response.body.model) }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"organization_id\\\", value: string(has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\") }, envoy.extensions.common.ratelimit.v3.RateLimitDescriptor.Entry { key: \\\"subscription\\\", value: string(auth.identity.selected_subscription) }] }],\\n    reservation_id: (kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) ? kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 : \\\"\\\",\\n    actual_amount: ((kuadrant.internal.response.body.total_tokens) != null) ? uint(kuadrant.internal.response.body.total_tokens) : 0u\\n}\", \"onReply\":[{\"isGuard\":false, \"logMessage\":\"Reserve commit failed: invalid gRPC response\", \"predicate\":\"!has(commit_response.reservation_released)\", \"terminal\":false, \"type\":\"fail\"}], \"predicate\":\"(auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")) && ((kuadrant.internal.tokenratelimit.reservation.tokenlimit_tokens_1000_per_1m__09f43f13 != null) || ((kuadrant.internal.response.body.total_tokens) != null))\", \"service\":\"ratelimit-commit-service\", \"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"], \"terminal\":false, \"type\":\"grpc\", \"var\":\"commit_response\"}], \"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\", \"routeRuleConditions\":{\"hostnames\":[\"*\"], \"predicates\":[\"request.url_path.startsWith(\\\"/\\\")\", \"request.headers.exists(h, h.lowerAscii() == \\\"x-gateway-model-name\\\" && request.headers[h] == \\\"publishers/llm/models/facebook/opt-125m-premium\\\")\"]}}], \"descriptorService\":\"kuadrant-operator-grpc\", \"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Check\", \"grpcService\":\"envoy.service.auth.v3.Authorization\", \"timeout\":\"2s\", \"type\":\"dynamic\"}, \"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"CheckRateLimit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-commit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Commit\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"deny\", \"grpcMethod\":\"Report\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-reserve-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"Reserve\", \"grpcService\":\"kuadrant.service.ratelimit.v1.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}, \"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\", \"failureMode\":\"allow\", \"grpcMethod\":\"ShouldRateLimit\", \"grpcService\":\"envoy.service.ratelimit.v3.RateLimitService\", \"timeout\":\"100ms\", \"type\":\"dynamic\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}},"runtime":"envoy.wasm.runtime.v8","vm_id":"fd5039db79d000f31669de1fde37ea175d3ad05f2b14341d6936fb564cab5553"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:45:43.486Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"new non-blocking error recorded","source":"IstioExtensionReconciler","operation":"update","resource":"openshift-ingress/kuadrant-maas-default-gateway","kind":"EnvoyFilter.networking.istio.io","error":"etcdserver: request is too large"}
{"level":"info","ts":"2026-11-02T00:45:43.486Z","logger":"kuadrant-operator.ReconciliationErrorHandler","msg":"scheduling retry for non-blocking errors","errorCount":1,"requeueAfter":2}
{"level":"info","ts":"2026-11-02T00:45:43.516Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T00:45:43.625Z","logger":"kuadrant-operator.PersistentErrorTracker","msg":"non-blocking error resolved","key":"EnvoyFilter.networking.istio.io/openshift-ingress/kuadrant-maas-default-gateway/update","attempts":1,"duration":0.138829669}
{"level":"info","ts":"2026-11-02T00:45:45.487Z","logger":"kuadrant-operator.KuadrantController","msg":"triggering reconciliation retry for non-blocking errors","errorCount":0}